# Managed Takedown

URL: https://www.deepinfo.com/platform/brp/managed-takedown/

## Hand Over the Finding. We File the Takedown.

Managed Takedown is the part of Brand Risk Protection where Deepinfo’s team does the reporting: it assembles the evidence, files the request with the party that can act, follows it up and checks the result. Your team decides what is fraudulent, and the takedown desk does the paperwork.

[Request demo](https://www.deepinfo.com/request-demo/) · [Talk to us about takedown](https://www.deepinfo.com/contact/)

### Every Step From Confirmed to Gone.

1. **Confirm**

   Your team marks a finding as fraudulent. For a domain, that is the approval step in [Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/).
2. **Assemble**

   The desk builds the case from the record: registration details, DNS and mail records, the certificate, and the web content with its history.
3. **File**

   The request goes to the party that can act on it. For a domain that is the registrar, the hosting provider, or both.
4. **Follow up**

   Abuse desks answer at their own pace and sometimes ask for more. The takedown desk handles the back and forth, so your team doesn’t have to.
5. **Check**

   Monitoring continues after the request. When the domain stops resolving or answering on the web, the next scan shows it, and an on-demand scan confirms it whenever you ask.

### Who Can Act on Each Finding.

A takedown request only works when it reaches someone with the power to act on it. This is who that is, channel by channel.

- **Lookalike domain**: The registrar, asked to suspend the registration
- **Phishing site on a lookalike**: The hosting provider, asked to remove the content
- **Impersonation account**: The social platform, asked to remove it under its impersonation policy
- **Fake app listing**: The store that lists it, asked to remove it under its publishing policy
- **Malicious ad or result**: The search engine, asked to remove it under its ad or content policy

Domains come from [Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/). Social, app-store and search coverage is confirmed per engagement.

### What the Desk Controls and What It Doesn’t.

We don’t quote turnaround times or success rates. The decision belongs to the registrar, host or platform that receives the request, and each one works to its own schedule.

We control

#### The Request

Complete evidence, the right recipient, the policy the abuse breaks, and follow-up until there is an answer.

They control

#### The Decision

Whether to act, and when. Registrars, hosts and platforms each run their own abuse process.

You see

#### The Outcome

The domain itself. Its DNS, mail, certificate and web indicators show whether it still answers, whatever any email says.

### In-House Filings Use the Same Record.

Some teams file their own reports, either all of them or only the cases their legal team wants to handle directly. Fraudulent domains export in bulk as JSON or CSV, using the filters you search with, and each one’s layer history is a request away.

- The name in both forms, and its type
- The rules that matched, with detection dates
- Monitoring indicators and the current risk score
- DNS, WHOIS, SSL, web data and port scan history, per domain

[Fraudulent Domain Export reference](https://docs.deepinfo.com/reference/brp/fraudulent-domain-export/)

Export the ones still answering

```bash
curl -X POST \
  "https://api.deepinfo.com/v1/brp/fraudulent-domains/search:export?format=json" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filters": {
      "must": [
        { "name": "monitoring_indicator.http",
          "type": "eq", "value": true }
      ]
    }
  }'
```

### Where Takedown Cases Come From.

- [Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/) (BRP): Lookalike domains matched against your brand keywords, confirmed by your team, then monitored.
- [Managed Takedown Services](https://www.deepinfo.com/solutions/use-cases/managed-takedown-services/) (Use case): How brand and fraud teams run takedown as an ongoing program.
- [Brand Impersonation Protection](https://www.deepinfo.com/solutions/use-cases/brand-impersonation-protection/) (Use case): Domains, accounts, apps and search results handled as one program.

### Query This Data Through the API

Lookalike matching runs over the domains the index sees each day. Data teams can take these domains as a feed and run their own matching.

- [Daily Registered Domains Feed](https://www.deepinfo.com/data-api/feeds/daily-registered-domain-names/)
- [Domain Search API](https://www.deepinfo.com/data-api/apis/domain-search/)
- [Same-Time Registered Domain Finder API](https://www.deepinfo.com/data-api/apis/same-time-registered-domain-finder/)

### Questions About Managed Takedown

**How long does a takedown take?**

It depends on who receives the request. Registrars, hosting providers and platforms each run their own abuse process on their own schedule, so we don’t publish a turnaround time we can’t control.

**Which findings can go to takedown?**

Confirmed fraudulent domains from [Fraudulent Domain Monitoring](https://www.deepinfo.com/platform/brp/fraudulent-domain-monitoring/). Impersonation on social platforms, app stores and search engines joins this workflow where that monitoring is in scope for you.

**What about a lookalike that isn’t live yet?**

It stays under watch. Its indicators show when it starts resolving, receiving mail, serving a certificate or answering on the web, and once it turns abusive the case can go to the desk.

**Can a takedown request be refused?**

Yes. The registrar, host or platform decides under its own abuse process, and it may ask for more evidence or decline. The desk handles that exchange, and the domain stays under monitoring whatever the answer.

**What happens if a domain comes back?**

A fraudulent domain stays under monitoring until your team removes it from the list. If it starts resolving or serving content again, its indicators show it on the next scan, and it can go back to the desk.

### See the Takedown Desk at Work.

Book a walk-through of the workflow with our team.

[Request demo](https://www.deepinfo.com/request-demo/)